Navigate

AC-3

AC-3: Access Enforcement

The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Supplemental

Access control policies (e.g., identity-based policies, role-based policies, control matrices, cryptography) control access between active entities or subjects (i.e., users or processes acting on behalf of users) and passive entities or objects (e.g., devices, files, records, domains) in information systems. In addition to enforcing authorized access at the information system level and recognizing that information systems can host many applications and services in support of organizational missions and business operations, access enforcement mechanisms can also be employed at the application and service level to provide increased information security.

CIA Levels
Confidentiality	high
Integrity	high
Availability	unknown

Overlays
Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

CSF Categories
PR.AC-4, PR.AC-6, PR.PT-3

Related Controls

The controls below (if any) were marked by NIST as being related to AC-3.

Control	Description
AC-2	The organization: a: Identifies and selects the following types of information system accounts to support organizational missions/business functions: [organization-defined information system account types]; b: Assigns account managers for information system accounts; c: Establishes conditions for group and role membership; d: Specifies authorized users of the information system, group and role membership, and access authorizations (i.e., privileges) and other attributes (as required) for each account; e: Requires approvals by [organization-defined personnel or roles] for requests to create information system accounts; f: Creates, enables, modifies, disables, and removes information system accounts in accordance with [organization-defined procedures or conditions]; g: Monitors the use of information system accounts; h: Notifies account managers: 1: When accounts are no longer required; 2: When users are terminated or transferred; and 3: When individual information system usage or need-to-know changes; i: Authorizes access to the information system based on: 1: A valid access authorization; 2: Intended system usage; and 3: Other attributes as required by the organization or associated missions/business functions; j: Reviews accounts for compliance with account management requirements [organization-defined frequency]; and k: Establishes a process for reissuing shared/group account credentials (if deployed) when individuals are removed from the group.
AC-4	The information system enforces approved authorizations for controlling the flow of information within the system and between interconnected systems based on [organization-defined information flow control policies].
AC-5	The organization: a: Separates [organization-defined duties of individuals]; b: Documents separation of duties of individuals; and c: Defines information system access authorizations to support separation of duties.
AC-6	The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.
AC-16	The organization: a: Provides the means to associate [organization-defined types of security attributes] having [organization-defined security attribute values] with information in storage, in process, and/or in transmission; b: Ensures that the security attribute associations are made and retained with the information; c: Establishes the permitted [organization-defined security attributes] for [organization-defined information systems]; and d: Determines the permitted [organization-defined values or ranges] for each of the established security attributes.
AC-17	The organization: a: Establishes and documents usage restrictions, configuration/connection requirements, and implementation guidance for each type of remote access allowed; and b: Authorizes remote access to the information system prior to allowing such connections.
AC-18	The organization: a: Establishes usage restrictions, configuration/connection requirements, and implementation guidance for wireless access; and b: Authorizes wireless access to the information system prior to allowing such connections.
AC-19	The organization: a: Establishes usage restrictions, configuration requirements, connection requirements, and implementation guidance for organization-controlled mobile devices; and b: Authorizes the connection of mobile devices to organizational information systems.
AC-20	The organization establishes terms and conditions, consistent with any trust relationships established with other organizations owning, operating, and/or maintaining external information systems, allowing authorized individuals to: a: Access the information system from external information systems; and b: Process, store, or transmit organization-controlled information using external information systems.
AC-21	The organization: a: Facilitates information sharing by enabling authorized users to determine whether access authorizations assigned to the sharing partner match the access restrictions on the information for [organization-defined information sharing circumstances where user discretion is required]; and b: Employs [organization-defined automated mechanisms or manual processes] to assist users in making information sharing/collaboration decisions.
AC-22	The organization: a: Designates individuals authorized to post information onto a publicly accessible information system; b: Trains authorized individuals to ensure that publicly accessible information does not contain nonpublic information; c: Reviews the proposed content of information prior to posting onto the publicly accessible information system to ensure that nonpublic information is not included; and d: Reviews the content on the publicly accessible information system for nonpublic information [organization-defined frequency] and removes such information, if discovered.
AU-9	The information system protects audit information and audit tools from unauthorized access, modification, and deletion.
CM-5	The organization defines, documents, approves, and enforces physical and logical access restrictions associated with changes to the information system.
CM-6	The organization: a: Establishes and documents configuration settings for information technology products employed within the information system using [organization-defined security configuration checklists] that reflect the most restrictive mode consistent with operational requirements; b: Implements the configuration settings; c: Identifies, documents, and approves any deviations from established configuration settings for [organization-defined information system components] based on [organization-defined operational requirements]; and d: Monitors and controls changes to the configuration settings in accordance with organizational policies and procedures.
CM-11	The organization: a: Establishes [organization-defined policies] governing the installation of software by users; b: Enforces software installation policies through [organization-defined methods]; and c: Monitors policy compliance at [organization-defined frequency].
MA-3	The organization approves, controls, and monitors information system maintenance tools.
MA-4	The organization: a: Approves and monitors nonlocal maintenance and diagnostic activities; b: Allows the use of nonlocal maintenance and diagnostic tools only as consistent with organizational policy and documented in the security plan for the information system; c: Employs strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions; d: Maintains records for nonlocal maintenance and diagnostic activities; and e: Terminates session and network connections when nonlocal maintenance is completed.
MA-5	The organization: a: Establishes a process for maintenance personnel authorization and maintains a list of authorized maintenance organizations or personnel; b: Ensures that non-escorted personnel performing maintenance on the information system have required access authorizations; and c: Designates organizational personnel with required access authorizations and technical competence to supervise the maintenance activities of personnel who do not possess the required access authorizations.
PE-3	The organization: a: Enforces physical access authorizations at [organization-defined entry/exit points to the facility where the information system resides] by; 1: Verifying individual access authorizations before granting access to the facility; and 2: Controlling ingress/egress to the facility using [one or more of {{ insert: param, pe-3_prm_3 }} /guards]; b: Maintains physical access audit logs for [organization-defined entry/exit points]; c: Provides [organization-defined security safeguards] to control access to areas within the facility officially designated as publicly accessible; d: Escorts visitors and monitors visitor activity [organization-defined circumstances requiring visitor escorts and monitoring]; e: Secures keys, combinations, and other physical access devices; f: Inventories [organization-defined physical access devices] every [organization-defined frequency]; and g: Changes combinations and keys [organization-defined frequency] and/or when keys are lost, combinations are compromised, or individuals are transferred or terminated.

Enhancements

The controls below (if any) add on to the requirements of AC-3.

Control	Description
AC-3(1)
AC-3(2)	The information system enforces dual authorization for [organization-defined privileged commands and/or other organization-defined actions].
AC-3(3)	The information system enforces [organization-defined mandatory access control policy] over all subjects and objects where the policy: (a): Is uniformly enforced across all subjects and objects within the boundary of the information system; (b): Specifies that a subject that has been granted access to information is constrained from doing any of the following; (1): Passing the information to unauthorized subjects or objects; (2): Granting its privileges to other subjects; (3): Changing one or more security attributes on subjects, objects, the information system, or information system components; (4): Choosing the security attributes and attribute values to be associated with newly created or modified objects; or (5): Changing the rules governing access control; and (c): Specifies that [organization-defined subjects] may explicitly be granted [organization-defined privileges (i.e., they are trusted subjects)] such that they are not limited by some or all of the above constraints.
AC-3(4)	The information system enforces [organization-defined discretionary access control policy] over defined subjects and objects where the policy specifies that a subject that has been granted access to information can do one or more of the following: (a): Pass the information to any other subjects or objects; (b): Grant its privileges to other subjects; (c): Change security attributes on subjects, objects, the information system, or the information system’s components; (d): Choose the security attributes to be associated with newly created or revised objects; or (e): Change the rules governing access control.
AC-3(5)	The information system prevents access to [organization-defined security-relevant information] except during secure, non-operable system states.
AC-3(6)
AC-3(7)	The information system enforces a role-based access control policy over defined subjects and objects and controls access based upon [organization-defined roles and users authorized to assume such roles].
AC-3(8)	The information system enforces the revocation of access authorizations resulting from changes to the security attributes of subjects and objects based on [organization-defined rules governing the timing of revocations of access authorizations].
AC-3(9)	The information system does not release information outside of the established system boundary unless: (a): The receiving [organization-defined information system or system component] provides [organization-defined security safeguards]; and (b): [organization-defined security safeguards] are used to validate the appropriateness of the information designated for release.
AC-3(10)	The organization employs an audited override of automated access control mechanisms under [organization-defined conditions].

Related CCIs

The CCIs below are tied to AC-3.

CCI	Definition
CCI-000213	Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.